Enable callers to control whether per-tenant usage metrics are included in calls to store.ServiceUsage (#20672)

* Enable callers to control whether per-tenant usage metrics are included in calls to store.ServiceUsage

* Add changelog

.changelog/20672.txt

@@ -0,0 +1,3 @@
+```release-note: improvement
+xds: Improved the performance of xDS server side load balancing. Its slightly improved in Consul CE with drastic CPU usage reductions in Consul Enterprise.
+```

agent/consul/operator_usage_endpoint.go

@@ -54,7 +54,7 @@ func (op *Operator) Usage(args *structs.OperatorUsageRequest, reply *structs.Usa
 		&reply.QueryMeta,
 		func(ws memdb.WatchSet, state *state.Store) error {
 			// Get service usage.
-			index, serviceUsage, err := state.ServiceUsage(ws)
+			index, serviceUsage, err := state.ServiceUsage(ws, true)
 			if err != nil {
 				return err
 			}

agent/consul/reporting/.mockery.yaml

@@ -0,0 +1,12 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+with-expecter: true
+all: true
+recursive: false
+mockname: "{{.InterfaceName}}"
+dir: "reportingmock"
+filename: "mock_{{.InterfaceName}}.go"
+outpkg: "reportingmock"
+packages:
+  github.com/hashicorp/consul/agent/consul/reporting:

agent/consul/reporting/reporting.go

@@ -36,7 +36,7 @@ type ServerDelegate interface {
 
 type StateDelegate interface {
 	NodeUsage() (uint64, state.NodeUsage, error)
-	ServiceUsage(ws memdb.WatchSet) (uint64, structs.ServiceUsage, error)
+	ServiceUsage(ws memdb.WatchSet, tenantUsage bool) (uint64, structs.ServiceUsage, error)
 }
 
 func NewReportingManager(logger hclog.Logger, deps EntDeps, server ServerDelegate, stateProvider StateDelegate) *ReportingManager {

agent/consul/reporting/reportingmock/mock_ServerDelegate.go

@@ -0,0 +1,168 @@
+// Code generated by mockery v2.37.1. DO NOT EDIT.
+
+package reportingmock
+
+import mock "github.com/stretchr/testify/mock"
+
+// ServerDelegate is an autogenerated mock type for the ServerDelegate type
+type ServerDelegate struct {
+	mock.Mock
+}
+
+type ServerDelegate_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *ServerDelegate) EXPECT() *ServerDelegate_Expecter {
+	return &ServerDelegate_Expecter{mock: &_m.Mock}
+}
+
+// GetSystemMetadata provides a mock function with given fields: key
+func (_m *ServerDelegate) GetSystemMetadata(key string) (string, error) {
+	ret := _m.Called(key)
+
+	var r0 string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string) (string, error)); ok {
+		return rf(key)
+	}
+	if rf, ok := ret.Get(0).(func(string) string); ok {
+		r0 = rf(key)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(key)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ServerDelegate_GetSystemMetadata_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetSystemMetadata'
+type ServerDelegate_GetSystemMetadata_Call struct {
+	*mock.Call
+}
+
+// GetSystemMetadata is a helper method to define mock.On call
+//   - key string
+func (_e *ServerDelegate_Expecter) GetSystemMetadata(key interface{}) *ServerDelegate_GetSystemMetadata_Call {
+	return &ServerDelegate_GetSystemMetadata_Call{Call: _e.mock.On("GetSystemMetadata", key)}
+}
+
+func (_c *ServerDelegate_GetSystemMetadata_Call) Run(run func(key string)) *ServerDelegate_GetSystemMetadata_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string))
+	})
+	return _c
+}
+
+func (_c *ServerDelegate_GetSystemMetadata_Call) Return(_a0 string, _a1 error) *ServerDelegate_GetSystemMetadata_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *ServerDelegate_GetSystemMetadata_Call) RunAndReturn(run func(string) (string, error)) *ServerDelegate_GetSystemMetadata_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// IsLeader provides a mock function with given fields:
+func (_m *ServerDelegate) IsLeader() bool {
+	ret := _m.Called()
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// ServerDelegate_IsLeader_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IsLeader'
+type ServerDelegate_IsLeader_Call struct {
+	*mock.Call
+}
+
+// IsLeader is a helper method to define mock.On call
+func (_e *ServerDelegate_Expecter) IsLeader() *ServerDelegate_IsLeader_Call {
+	return &ServerDelegate_IsLeader_Call{Call: _e.mock.On("IsLeader")}
+}
+
+func (_c *ServerDelegate_IsLeader_Call) Run(run func()) *ServerDelegate_IsLeader_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *ServerDelegate_IsLeader_Call) Return(_a0 bool) *ServerDelegate_IsLeader_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *ServerDelegate_IsLeader_Call) RunAndReturn(run func() bool) *ServerDelegate_IsLeader_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// SetSystemMetadataKey provides a mock function with given fields: key, val
+func (_m *ServerDelegate) SetSystemMetadataKey(key string, val string) error {
+	ret := _m.Called(key, val)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, string) error); ok {
+		r0 = rf(key, val)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// ServerDelegate_SetSystemMetadataKey_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'SetSystemMetadataKey'
+type ServerDelegate_SetSystemMetadataKey_Call struct {
+	*mock.Call
+}
+
+// SetSystemMetadataKey is a helper method to define mock.On call
+//   - key string
+//   - val string
+func (_e *ServerDelegate_Expecter) SetSystemMetadataKey(key interface{}, val interface{}) *ServerDelegate_SetSystemMetadataKey_Call {
+	return &ServerDelegate_SetSystemMetadataKey_Call{Call: _e.mock.On("SetSystemMetadataKey", key, val)}
+}
+
+func (_c *ServerDelegate_SetSystemMetadataKey_Call) Run(run func(key string, val string)) *ServerDelegate_SetSystemMetadataKey_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(string), args[1].(string))
+	})
+	return _c
+}
+
+func (_c *ServerDelegate_SetSystemMetadataKey_Call) Return(_a0 error) *ServerDelegate_SetSystemMetadataKey_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *ServerDelegate_SetSystemMetadataKey_Call) RunAndReturn(run func(string, string) error) *ServerDelegate_SetSystemMetadataKey_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewServerDelegate creates a new instance of ServerDelegate. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewServerDelegate(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *ServerDelegate {
+	mock := &ServerDelegate{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

agent/consul/reporting/reportingmock/mock_StateDelegate.go

@@ -0,0 +1,157 @@
+// Code generated by mockery v2.37.1. DO NOT EDIT.
+
+package reportingmock
+
+import (
+	memdb "github.com/hashicorp/go-memdb"
+	mock "github.com/stretchr/testify/mock"
+
+	state "github.com/hashicorp/consul/agent/consul/state"
+
+	structs "github.com/hashicorp/consul/agent/structs"
+)
+
+// StateDelegate is an autogenerated mock type for the StateDelegate type
+type StateDelegate struct {
+	mock.Mock
+}
+
+type StateDelegate_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *StateDelegate) EXPECT() *StateDelegate_Expecter {
+	return &StateDelegate_Expecter{mock: &_m.Mock}
+}
+
+// NodeUsage provides a mock function with given fields:
+func (_m *StateDelegate) NodeUsage() (uint64, state.NodeUsage, error) {
+	ret := _m.Called()
+
+	var r0 uint64
+	var r1 state.NodeUsage
+	var r2 error
+	if rf, ok := ret.Get(0).(func() (uint64, state.NodeUsage, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func() state.NodeUsage); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Get(1).(state.NodeUsage)
+	}
+
+	if rf, ok := ret.Get(2).(func() error); ok {
+		r2 = rf()
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
+}
+
+// StateDelegate_NodeUsage_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'NodeUsage'
+type StateDelegate_NodeUsage_Call struct {
+	*mock.Call
+}
+
+// NodeUsage is a helper method to define mock.On call
+func (_e *StateDelegate_Expecter) NodeUsage() *StateDelegate_NodeUsage_Call {
+	return &StateDelegate_NodeUsage_Call{Call: _e.mock.On("NodeUsage")}
+}
+
+func (_c *StateDelegate_NodeUsage_Call) Run(run func()) *StateDelegate_NodeUsage_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *StateDelegate_NodeUsage_Call) Return(_a0 uint64, _a1 state.NodeUsage, _a2 error) *StateDelegate_NodeUsage_Call {
+	_c.Call.Return(_a0, _a1, _a2)
+	return _c
+}
+
+func (_c *StateDelegate_NodeUsage_Call) RunAndReturn(run func() (uint64, state.NodeUsage, error)) *StateDelegate_NodeUsage_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ServiceUsage provides a mock function with given fields: ws, tenantUsage
+func (_m *StateDelegate) ServiceUsage(ws memdb.WatchSet, tenantUsage bool) (uint64, structs.ServiceUsage, error) {
+	ret := _m.Called(ws, tenantUsage)
+
+	var r0 uint64
+	var r1 structs.ServiceUsage
+	var r2 error
+	if rf, ok := ret.Get(0).(func(memdb.WatchSet, bool) (uint64, structs.ServiceUsage, error)); ok {
+		return rf(ws, tenantUsage)
+	}
+	if rf, ok := ret.Get(0).(func(memdb.WatchSet, bool) uint64); ok {
+		r0 = rf(ws, tenantUsage)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(memdb.WatchSet, bool) structs.ServiceUsage); ok {
+		r1 = rf(ws, tenantUsage)
+	} else {
+		r1 = ret.Get(1).(structs.ServiceUsage)
+	}
+
+	if rf, ok := ret.Get(2).(func(memdb.WatchSet, bool) error); ok {
+		r2 = rf(ws, tenantUsage)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
+}
+
+// StateDelegate_ServiceUsage_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ServiceUsage'
+type StateDelegate_ServiceUsage_Call struct {
+	*mock.Call
+}
+
+// ServiceUsage is a helper method to define mock.On call
+//   - ws memdb.WatchSet
+//   - tenantUsage bool
+func (_e *StateDelegate_Expecter) ServiceUsage(ws interface{}, tenantUsage interface{}) *StateDelegate_ServiceUsage_Call {
+	return &StateDelegate_ServiceUsage_Call{Call: _e.mock.On("ServiceUsage", ws, tenantUsage)}
+}
+
+func (_c *StateDelegate_ServiceUsage_Call) Run(run func(ws memdb.WatchSet, tenantUsage bool)) *StateDelegate_ServiceUsage_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(memdb.WatchSet), args[1].(bool))
+	})
+	return _c
+}
+
+func (_c *StateDelegate_ServiceUsage_Call) Return(_a0 uint64, _a1 structs.ServiceUsage, _a2 error) *StateDelegate_ServiceUsage_Call {
+	_c.Call.Return(_a0, _a1, _a2)
+	return _c
+}
+
+func (_c *StateDelegate_ServiceUsage_Call) RunAndReturn(run func(memdb.WatchSet, bool) (uint64, structs.ServiceUsage, error)) *StateDelegate_ServiceUsage_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// NewStateDelegate creates a new instance of StateDelegate. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewStateDelegate(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *StateDelegate {
+	mock := &StateDelegate{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

agent/consul/state/usage.go

@@ -410,7 +410,7 @@ func (s *Store) PeeringUsage() (uint64, PeeringUsage, error) {
 
 // ServiceUsage returns the latest seen Raft index, a compiled set of service
 // usage data, and any errors.
-func (s *Store) ServiceUsage(ws memdb.WatchSet) (uint64, structs.ServiceUsage, error) {
+func (s *Store) ServiceUsage(ws memdb.WatchSet, tenantUsage bool) (uint64, structs.ServiceUsage, error) {
 	tx := s.db.ReadTxn()
 	defer tx.Abort()
 
@@ -450,6 +450,12 @@ func (s *Store) ServiceUsage(ws memdb.WatchSet) (uint64, structs.ServiceUsage, e
 		BillableServiceInstances: billableServiceInstances.Count,
 		Nodes:                    nodes.Count,
 	}
+
+	// Unless we need to gather per-tenant usage go ahead and return what we have
+	if !tenantUsage {
+		return serviceInstances.Index, usage, nil
+	}
+
 	results, err := compileEnterpriseServiceUsage(ws, tx, usage)
 	if err != nil {
 		return 0, structs.ServiceUsage{}, fmt.Errorf("failed services lookup: %s", err)

agent/consul/state/usage_test.go

@@ -155,7 +155,7 @@ func TestStateStore_Usage_ServiceUsageEmpty(t *testing.T) {
 	s := testStateStore(t)
 
 	// No services have been registered, and thus no usage entry exists
-	idx, usage, err := s.ServiceUsage(nil)
+	idx, usage, err := s.ServiceUsage(nil, true)
 	require.NoError(t, err)
 	require.Equal(t, idx, uint64(0))
 	require.Equal(t, usage.Services, 0)
@@ -186,7 +186,7 @@ func TestStateStore_Usage_ServiceUsage(t *testing.T) {
 	testRegisterAPIService(t, s, 20, "node2", "api")
 
 	ws := memdb.NewWatchSet()
-	idx, usage, err := s.ServiceUsage(ws)
+	idx, usage, err := s.ServiceUsage(ws, true)
 	require.NoError(t, err)
 	require.Equal(t, idx, uint64(20))
 	require.Equal(t, 9, usage.Services)
@@ -232,7 +232,7 @@ func TestStateStore_Usage_ServiceUsage_DeleteNode(t *testing.T) {
 	testRegisterSidecarProxy(t, s, 3, "node1", "service2")
 	testRegisterConnectNativeService(t, s, 4, "node1", "service-connect")
 
-	idx, usage, err := s.ServiceUsage(nil)
+	idx, usage, err := s.ServiceUsage(nil, true)
 	require.NoError(t, err)
 	require.Equal(t, idx, uint64(4))
 	require.Equal(t, 3, usage.Services)
@@ -243,7 +243,7 @@ func TestStateStore_Usage_ServiceUsage_DeleteNode(t *testing.T) {
 
 	require.NoError(t, s.DeleteNode(4, "node1", nil, ""))
 
-	idx, usage, err = s.ServiceUsage(nil)
+	idx, usage, err = s.ServiceUsage(nil, true)
 	require.NoError(t, err)
 	require.Equal(t, idx, uint64(4))
 	require.Equal(t, usage.Services, 0)
@@ -272,7 +272,7 @@ func TestStateStore_Usage_ServiceUsagePeering(t *testing.T) {
 	testRegisterConnectNativeService(t, s, 7, "node2", "service-native")
 
 	testutil.RunStep(t, "writes", func(t *testing.T) {
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, uint64(7), idx)
 		require.Equal(t, 3, usage.Services)
@@ -285,7 +285,7 @@ func TestStateStore_Usage_ServiceUsagePeering(t *testing.T) {
 	testutil.RunStep(t, "deletes", func(t *testing.T) {
 		require.NoError(t, s.DeleteNode(7, "node1", nil, peerName))
 		require.NoError(t, s.DeleteNode(8, "node2", nil, ""))
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, uint64(8), idx)
 		require.Equal(t, 0, usage.Services)
@@ -324,7 +324,7 @@ func TestStateStore_Usage_Restore(t *testing.T) {
 	require.Equal(t, idx, uint64(9))
 	require.Equal(t, nodeUsage.Nodes, 1)
 
-	idx, usage, err := s.ServiceUsage(nil)
+	idx, usage, err := s.ServiceUsage(nil, true)
 	require.NoError(t, err)
 	require.Equal(t, idx, uint64(9))
 	require.Equal(t, usage.Services, 1)
@@ -425,7 +425,7 @@ func TestStateStore_Usage_ServiceUsage_updatingService(t *testing.T) {
 		require.NoError(t, s.EnsureService(2, "node1", svc))
 
 		// We renamed a service with a single instance, so we maintain 1 service.
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(2))
 		require.Equal(t, usage.Services, 1)
@@ -446,7 +446,7 @@ func TestStateStore_Usage_ServiceUsage_updatingService(t *testing.T) {
 		require.NoError(t, s.EnsureService(3, "node1", svc))
 
 		// We renamed a service with a single instance, so we maintain 1 service.
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(3))
 		require.Equal(t, usage.Services, 1)
@@ -468,7 +468,7 @@ func TestStateStore_Usage_ServiceUsage_updatingService(t *testing.T) {
 		require.NoError(t, s.EnsureService(4, "node1", svc))
 
 		// We renamed a service with a single instance, so we maintain 1 service.
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(4))
 		require.Equal(t, usage.Services, 1)
@@ -500,7 +500,7 @@ func TestStateStore_Usage_ServiceUsage_updatingService(t *testing.T) {
 		}
 		require.NoError(t, s.EnsureService(6, "node1", svc3))
 
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(6))
 		require.Equal(t, usage.Services, 2)
@@ -519,7 +519,7 @@ func TestStateStore_Usage_ServiceUsage_updatingService(t *testing.T) {
 		}
 		require.NoError(t, s.EnsureService(7, "node1", update))
 
-		idx, usage, err = s.ServiceUsage(nil)
+		idx, usage, err = s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(7))
 		require.Equal(t, usage.Services, 3)
@@ -546,7 +546,7 @@ func TestStateStore_Usage_ServiceUsage_updatingConnectProxy(t *testing.T) {
 		require.NoError(t, s.EnsureService(2, "node1", svc))
 
 		// We renamed a service with a single instance, so we maintain 1 service.
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(2))
 		require.Equal(t, usage.Services, 1)
@@ -573,7 +573,7 @@ func TestStateStore_Usage_ServiceUsage_updatingConnectProxy(t *testing.T) {
 		}
 		require.NoError(t, s.EnsureService(4, "node1", svc3))
 
-		idx, usage, err := s.ServiceUsage(nil)
+		idx, usage, err := s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(4))
 		require.Equal(t, usage.Services, 2)
@@ -589,7 +589,7 @@ func TestStateStore_Usage_ServiceUsage_updatingConnectProxy(t *testing.T) {
 		}
 		require.NoError(t, s.EnsureService(5, "node1", update))
 
-		idx, usage, err = s.ServiceUsage(nil)
+		idx, usage, err = s.ServiceUsage(nil, true)
 		require.NoError(t, err)
 		require.Equal(t, idx, uint64(5))
 		require.Equal(t, usage.Services, 3)

agent/consul/usagemetrics/usagemetrics.go

@@ -226,7 +226,7 @@ func (u *UsageMetricsReporter) runOnce() {
 
 	u.emitPeeringUsage(peeringUsage)
 
-	_, serviceUsage, err := state.ServiceUsage(nil)
+	_, serviceUsage, err := state.ServiceUsage(nil, true)
 	if err != nil {
 		u.logger.Warn("failed to retrieve services from state store", "error", err)
 	}

agent/consul/xdscapacity/capacity.go

@@ -187,7 +187,9 @@ func (c *Controller) countProxies(ctx context.Context) (<-chan error, uint32, er
 		ws.Add(store.AbandonCh())
 
 		var count uint32
-		_, usage, err := store.ServiceUsage(ws)
+		// we don't care about the per-tenant counts so avoid excessive cpu utilization
+		// and don't aggregate that information
+		_, usage, err := store.ServiceUsage(ws, false)
 
 		// Query failed? Wait for a while, and then go to the top of the loop to
 		// retry (unless the context is cancelled).
@@ -209,5 +211,5 @@ func (c *Controller) countProxies(ctx context.Context) (<-chan error, uint32, er
 
 type Store interface {
 	AbandonCh() <-chan struct{}
-	ServiceUsage(ws memdb.WatchSet) (uint64, structs.ServiceUsage, error)
+	ServiceUsage(ws memdb.WatchSet, tenantUsage bool) (uint64, structs.ServiceUsage, error)
 }

agent/consul/xdscapacity/capacity_test.go

@@ -137,3 +137,56 @@ func TestCalcRateLimit(t *testing.T) {
 		require.Equalf(t, out, calcRateLimit(in), "calcRateLimit(%d)", in)
 	}
 }
+
+func BenchmarkCountProxies(b *testing.B) {
+	const index = 123
+
+	store := state.NewStateStore(nil)
+
+	// This loop generates:
+	//
+	//	4 (service kind) * 100 (service) * 5 * (node) = 2000 proxy services. And 500 non-proxy services.
+	for _, kind := range []structs.ServiceKind{
+		// These will be included in the count.
+		structs.ServiceKindConnectProxy,
+		structs.ServiceKindIngressGateway,
+		structs.ServiceKindTerminatingGateway,
+		structs.ServiceKindMeshGateway,
+
+		// This one will not.
+		structs.ServiceKindTypical,
+	} {
+		for i := 0; i < 100; i++ {
+			serviceName := fmt.Sprintf("%s-%d", kind, i)
+
+			for j := 0; j < 5; j++ {
+				nodeName := fmt.Sprintf("%s-node-%d", serviceName, j)
+
+				require.NoError(b, store.EnsureRegistration(index, &structs.RegisterRequest{
+					Node: nodeName,
+					Service: &structs.NodeService{
+						ID:      serviceName,
+						Service: serviceName,
+						Kind:    kind,
+					},
+				}))
+			}
+		}
+	}
+
+	ctx := testutil.TestContext(b)
+	c := &Controller{
+		cfg: Config{
+			GetStore: func() Store { return store },
+		},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, numProxies, err := c.countProxies(ctx); err != nil {
+			b.Fatalf("encountered unexpected error: %v", err)
+		} else if numProxies != 2000 {
+			b.Fatalf("unexpected count: %d", numProxies)
+		}
+	}
+}